| ID | Event Description |
|---|---|
| 4618 | A monitored security event pattern has occurred. Audit Success |
| 4624 | An account was successfully logged on CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171, PCI-DSS |
| 4625 | An account failed to log on Audit Failure, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST SP 800-53, NIST 800-171, CMMC L1 |
| 4626 | User / Device claims information Audit Success |
| 4627 | Group membership information Audit Success |
| 4634 | An account was logged off Audit Success |
| 4647 | User initiated logoff Audit Success |
| 4688 | A new process has been created NIST 800-171, NIST SP 800-53, Audit Success, ISO 27001:2013, CMMC L3 |
| 4696 | A primary token was assigned to process Audit Success |
| 4703 | A token right was adjusted Audit Success, CMMC L2, NIST800-171, NIST800-53 |
| 4800 | The workstation was locked Audit Success, ISO 27001:2013, NIST 800-171, NIST SP 800-53, CMMC L3 |
| 4801 | The workstation was unlocked ISO 27001:2013, Audit Success, NIST 800-171, NIST SP 800-53, CMMC L3 |
| 4912 | Per User Audit Policy was changed Audit Success |